General

  • Target

    SOLARAUPDATE.zip

  • Size

    24.2MB

  • Sample

    240606-pknb8afa55

  • MD5

    0414bce315fab0d72a1b93ccb08a6104

  • SHA1

    122196a612d11c83856ed4c5c2c456d800a705a3

  • SHA256

    21d5cc62e1e9c967f89a944bd62f92f5f952f5e0e6c84b4732ae5167efa106a9

  • SHA512

    bc213459ced075739ceeea30ca07d811f6664aab2fbc6c3dab44a0b70ad21a24ae98ea86caa16aac6b1074d3b6f9fda5f3eee818ee40c21d995d68c3e04d3d13

  • SSDEEP

    393216:3ZoQn1/kODLWk6P6ddxqrYpygY9uiTnqZcdsrc6/mDyAYgWE+8qNUuZysB:311Ruk6PBzHTvWc6/mXYgWDU6ysB

Malware Config

Targets

    • Target

      SOLARAUPDATE.zip

    • Size

      24.2MB

    • MD5

      0414bce315fab0d72a1b93ccb08a6104

    • SHA1

      122196a612d11c83856ed4c5c2c456d800a705a3

    • SHA256

      21d5cc62e1e9c967f89a944bd62f92f5f952f5e0e6c84b4732ae5167efa106a9

    • SHA512

      bc213459ced075739ceeea30ca07d811f6664aab2fbc6c3dab44a0b70ad21a24ae98ea86caa16aac6b1074d3b6f9fda5f3eee818ee40c21d995d68c3e04d3d13

    • SSDEEP

      393216:3ZoQn1/kODLWk6P6ddxqrYpygY9uiTnqZcdsrc6/mDyAYgWE+8qNUuZysB:311Ruk6PBzHTvWc6/mXYgWDU6ysB

    Score
    1/10
    • Target

      SOLARAUPDATED/SOLARAB.exe

    • Size

      23.3MB

    • MD5

      c4012ff5cd49e7f4352895f89cbaa982

    • SHA1

      1be267ec4d314cfca7ebd33c530cde5f2e15dac7

    • SHA256

      bdeb7557669f81666d9856ca2e5c72dd74d5c707cfa78fdb6de7dc83c387ee19

    • SHA512

      2d722420bb6dac751d3d520bfdf1ee6481952f6e3101c23ec2a75ac59ab0810f8a0c97e8595e5a064b92b220d9293b74159e91bca12f4ecc9cb30f2e04f0d2f6

    • SSDEEP

      393216:8o9DM45CsKh2Jp5M/urEUWj5EnBSVkRIrY87FNwrcf+E6PcZYE9utK+:p9NJKhNdbQzcY87Fycf+8YEWK+

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Target

      SOLARAB.pyc

    • Size

      44KB

    • MD5

      0b4fbb0e2121e8d85e9e324307b2f186

    • SHA1

      fc14e82fb8ad20db541a650c8b3f377683079e15

    • SHA256

      b2a3b5f61d94decaa3e4bf6fd9d4836525413b75d9c11370cfbb84a2a89d8d03

    • SHA512

      42a8a9cc7d0c3da2188251e5457de364040f2024800b885d9d18cc96d46da447fdcda53090ed925089de7191f206a310b4edd4f0ddf271b63f0ca407fd138485

    • SSDEEP

      768:n9JWQMr0q6nEPqm0HSmwUqRe8Ie2cxtaaEws4YHE6D9fJOyeWDlhLx3+pJ6y:n9JWh4q6noqmI+1Rr6cxRPeEuTdNDlho

    Score
    3/10
    • Target

      SOLARAUPDATED/autoexecute/test.txt

    • Size

      69B

    • MD5

      8117b088670ace343038cc9e404d5448

    • SHA1

      b293a8ea46badf3268312b03ffdcbd87936070d2

    • SHA256

      f7a90e5208841b920b622e0c94eb32653daa297c07d3f8e4abd532201dd5165f

    • SHA512

      574acf89b137f2ea2259ec704e76ac04fab40a4166f1b5957fc5701bffbefb25ea8d5e1efadc5a2c7249acd6bde419c759589b37f073b162b25bed29ee677d26

    Score
    1/10
    • Target

      SOLARAUPDATED/bin/api-docs.json

    • Size

      5.9MB

    • MD5

      19c541f355cad5fb427a38317479b698

    • SHA1

      aebc5b3b123ab962606b6072806027d9b6c758e9

    • SHA256

      6c003208304e585290c9a655c51e5789c4f3e4241a9abc0139a9dbeb5d2884b1

    • SHA512

      78e3cbe554cdf02457a3892033ebd9f74c5b4446e306248594d682918ea5dc6e52cafe72b3bdf59fda1f9f5b3879576ca1ef2d35cebc66f1d55543b618bcf7e5

    • SSDEEP

      24576:7ccjk1+ox2ptidmo2KtMTdxsuBqXhGz+rM:hiVuBqXhGz+rM

    Score
    3/10
    • Target

      SOLARAUPDATED/bin/incognito-luau.dll

    • Size

      1.3MB

    • MD5

      157fd035b2a344a94166d7db3756df0e

    • SHA1

      f221d28c1deb80b4e8d9201226435aefce6b0f75

    • SHA256

      8716c75aff75941711aff8770836f47eb9a254416089ef3571c6fc9a338b3009

    • SHA512

      fad0174fbd22f58dd4fcdaad8378c214270b4faeaca64d9cb306f50e9316072a4c417c5723c4123b8bf94a3dba6ef4e3303ec60f4a2cf0c3a54d8ab375ea717d

    • SSDEEP

      24576:ZqBSLRktEBl6blwTUMD4zB1VU2bFjYWR0pMQUAqLRAovh4bSAXVVRNRfMXZO:ZqBSLRkt8l6blSU//+2bFfvA1SQVVRNk

    Score
    1/10
    • Target

      SOLARAUPDATED/bin/save.json

    • Size

      46B

    • MD5

      877b13372acbf8bf740694d141d1aeb0

    • SHA1

      0c764bef8a7c94ef610c129720d3d3d9a66fea3f

    • SHA256

      1bc3e6bcf3d47756fe6e456ce68165d39ea8358186d1a9bb4b2e5911389b22c1

    • SHA512

      38a6a7e7bf9572daeabbafb7bb1868d09f9b487e84e17da263f627315623952ab203c8dc5e940b6d59d15183bdd43d153a08ae421f12d085480e73fcbc3b5b82

    Score
    3/10
    • Target

      SOLARAUPDATED/scripts/test.lua

    • Size

      15B

    • MD5

      45952b4f4540d4ea32b1a56b40dfcb54

    • SHA1

      c43f61758aede460274cbe0a7a52ed3a8e06201a

    • SHA256

      819627eee839b974a3a9905ea4f98b1fce63b9ef68a9a1030b39c52ec2046999

    • SHA512

      5fae4efa4037c96b3012e825e1041ecb419b8b6ce6eeb2f4667228874ddb7be48137d9118dc676e6d1f430e71f68809837e4caea8fd65f6100624e63abb81e8a

    Score
    3/10
    • Target

      SOLARAUPDATED/workspace/.tests/appendfile.txt

    • Size

      7B

    • MD5

      260ca9dd8a4577fc00b7bd5810298076

    • SHA1

      53a5687cb26dc41f2ab4033e97e13adefd3740d6

    • SHA256

      aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

    • SHA512

      51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

    Score
    1/10
    • Target

      SOLARAUPDATED/workspace/.tests/getcustomasset.txt

    • Size

      7B

    • MD5

      260ca9dd8a4577fc00b7bd5810298076

    • SHA1

      53a5687cb26dc41f2ab4033e97e13adefd3740d6

    • SHA256

      aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

    • SHA512

      51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

    Score
    1/10
    • Target

      SOLARAUPDATED/workspace/.tests/isfile.txt

    • Size

      7B

    • MD5

      260ca9dd8a4577fc00b7bd5810298076

    • SHA1

      53a5687cb26dc41f2ab4033e97e13adefd3740d6

    • SHA256

      aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

    • SHA512

      51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

    Score
    1/10
    • Target

      SOLARAUPDATED/workspace/.tests/listfiles/test_1.txt

    • Size

      7B

    • MD5

      260ca9dd8a4577fc00b7bd5810298076

    • SHA1

      53a5687cb26dc41f2ab4033e97e13adefd3740d6

    • SHA256

      aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

    • SHA512

      51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

    Score
    1/10
    • Target

      SOLARAUPDATED/workspace/.tests/listfiles/test_2.txt

    • Size

      7B

    • MD5

      260ca9dd8a4577fc00b7bd5810298076

    • SHA1

      53a5687cb26dc41f2ab4033e97e13adefd3740d6

    • SHA256

      aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

    • SHA512

      51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

    Score
    1/10
    • Target

      SOLARAUPDATED/workspace/.tests/loadfile.txt

    • Size

      1B

    • MD5

      8fa14cdd754f91cc6554c9e71929cce7

    • SHA1

      4a0a19218e082a343a1b17e5333409af9d98f0f5

    • SHA256

      252f10c83610ebca1a059c0bae8255eba2f95be4d1d7bcfa89d7248a82d9f111

    • SHA512

      711c22448e721e5491d8245b49425aa861f1fc4a15287f0735e203799b65cffec50b5abd0fddd91cd643aeb3b530d48f05e258e7e230a94ed5025c1387bb4e1b

    Score
    1/10
    • Target

      SOLARAUPDATED/workspace/.tests/readfile.txt

    • Size

      7B

    • MD5

      260ca9dd8a4577fc00b7bd5810298076

    • SHA1

      53a5687cb26dc41f2ab4033e97e13adefd3740d6

    • SHA256

      aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

    • SHA512

      51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

    Score
    1/10
    • Target

      SOLARAUPDATED/workspace/.tests/writefile

    • Size

      7B

    • MD5

      260ca9dd8a4577fc00b7bd5810298076

    • SHA1

      53a5687cb26dc41f2ab4033e97e13adefd3740d6

    • SHA256

      aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

    • SHA512

      51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks

static1

pyinstaller
Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

upx
Score
7/10

behavioral4

executionspywarestealerupx
Score
8/10

behavioral5

Score
3/10

behavioral6

Score
3/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
3/10

behavioral10

Score
3/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
3/10

behavioral14

Score
3/10

behavioral15

Score
3/10

behavioral16

Score
3/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10